What makes a password strong
A strong password is one that's hard to guess and hard to crack. Those are different problems. Guessing attacks work against predictable patterns — dictionary words, names, dates, keyboard walks like "qwerty123". Cracking attacks work against short passwords by trying every possible combination. A strong password defeats both: it's random enough that prediction fails, and long enough that exhaustive search is computationally impractical.
The measure of this is entropy — a number in bits that represents how unpredictable a password is. A password drawn from a 72-character set (uppercase, lowercase, digits, common symbols) at 20 characters long has roughly 125 bits of entropy. At current computing speeds, that's not crackable in any realistic timeframe. Human-chosen passwords, by contrast, tend to cluster around a tiny fraction of the theoretical space — people use the same predictable substitutions (@ for a, 3 for e, ! at the end) and the same word categories.
Length vs complexity
Between length and character-set complexity, length wins. A 20-character password using only lowercase letters has more entropy than a 10-character password using the full 72-character set. Both length and complexity matter, but if you have to choose, add characters rather than add symbol requirements.
For practical minimums: 12 characters is adequate for lower-risk accounts where breached-password detection is active. For email accounts, password managers, banking, and anything that controls other accounts, use 20 or more characters. The password generator defaults to 16 characters with all character types enabled — adjust upward for critical accounts.
How to generate a strong password
Open the password generator and set your length. Enable the character types your target site accepts — most accept uppercase, lowercase, numbers, and symbols; a few don't allow symbols. Click Generate. The tool uses your browser's crypto.getRandomValues() API to produce a cryptographically random result — not a predictable pseudo-random sequence.
Copy the password directly from the output field and paste it into your password manager before going to the site. Don't type it from memory, don't save it in a text file, and don't reuse it. If the site rejects a character (some reject certain symbols), regenerate with that character type disabled rather than modifying the password yourself — human modifications add predictability.
Where generated passwords work
Generated passwords are the right choice for any account you access via a password manager. You type the password once (into the manager), then autofill handles every subsequent login. The password itself never needs to be memorable — only the master password for the manager does.
They're less practical for accounts you need to type manually — a router admin panel, a smart TV app, a work VPN that doesn't support autofill. For those, a shorter generated password or a passphrase of random words is easier to type without introducing predictability.
Security notes
The generator runs entirely client-side. The password appears in your browser and goes nowhere else — no server request is made when you click Generate. You can verify this by opening your browser's network tab before clicking Generate and watching that no request fires.
The weakest link is usually not the password itself but what happens to it afterward. A strong generated password stored in a plain text file, sent over email, or reused across sites negates the security gain. Use a dedicated password manager (Bitwarden, 1Password, or similar) and enable two-factor authentication on every account that offers it.
The right password for each account
One strong, unique password per account is the baseline. Generated passwords make that practical — you don't need to remember them, you just need the generator and a password manager. The UUID generator is useful for a related purpose: creating unique identifiers for application keys, session tokens, and database records where uniqueness rather than secrecy is the goal.
The effort of setting up a password manager once and using generated passwords from that point forward is low. The alternative — reusing predictable passwords across accounts — means a single breach exposes every account that shares the password.